General

  • Target

    Porno_Izle.apk

  • Size

    2.9MB

  • Sample

    210812-3jeabq1c36

  • MD5

    eb73dee8702ed7e3582e4d6ac3f47e74

  • SHA1

    eb2ed2bed4c2a0409d7e17034b408ca676dbb254

  • SHA256

    29e4bdd32b7f308d1a138dcff54c30ac11aa5c178f6e19fe413c7999fdb120a9

  • SHA512

    d24c3ffbc340c86c3f471c510bcadf41dc591199f9166865e685eacd71abea24d7868000cd91d35c3e1e0d0988229014601c3c892f12a6e96cc396acca5ab4fe

Malware Config

Extracted

Family

alienbot

C2

http://194.163.136.78

Targets

    • Target

      Porno_Izle.apk

    • Size

      2.9MB

    • MD5

      eb73dee8702ed7e3582e4d6ac3f47e74

    • SHA1

      eb2ed2bed4c2a0409d7e17034b408ca676dbb254

    • SHA256

      29e4bdd32b7f308d1a138dcff54c30ac11aa5c178f6e19fe413c7999fdb120a9

    • SHA512

      d24c3ffbc340c86c3f471c510bcadf41dc591199f9166865e685eacd71abea24d7868000cd91d35c3e1e0d0988229014601c3c892f12a6e96cc396acca5ab4fe

    • Alienbot

      Alienbot is a fork of Cerberus banker first seen in January 2020.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads name of network operator

      Uses Android APIs to discover system information.

MITRE ATT&CK Matrix

Tasks